1998106 - Infinity fallback value in anchor() crashes the tab

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Nicolas Chevobbe [:nchevobbe]]

Attachment: anchor-infinity-fallback.html

(From https://mastodon.social/@Meyerweb/115489174135492911)

Steps to reproduce

1. Open attached document

Actual results

The page crashes

---

Here's the CSS

.anchor {
  anchor-name: --infobox;
}

.positionedElement {
  position: absolute;
  position-anchor: --infobox;
  left: calc(anchor(top, Infinity) + 10px);
}

Comment 1

[Eric A. Meyer]

It turns out this happens with more than just Infinity. For example, I tested the above but changed line 11 to read:

      left: calc(anchor(top, 0) + 10px);

Once more tab still crashed. However, with this change to line 11:

      left: calc(anchor(top, 1px) + 10px);

…the tab did not crash. In a limited test of other non-zero length values, I was unable to get another crash. Indeed, even this was rendered without any issue:

      left: calc(anchor(top, calc(1em - 1em)) + 10px);

Comment 2

[Eric A. Meyer]

Just a bit more info: I tried this for line 11, and got a crash:

      left: calc(anchor(top, calc(0)) + 10px);

When I added a unit, the crash went away:

      left: calc(anchor(top, calc(0px)) + 10px);

I could even change the unit to em or q and still avoid the crash. Fascinating!

Comment 3

[Eric A. Meyer]

Okay, last one, I swear. This also avoided a crash:

      left: anchor(top, 0px);

So the problem is maybe due to a unitless value in the fallback?

Comment 4

[David Shin[:dshin]]

Attachment: Bug 1998106: Ensure that <number> fallbacks are disallowed in fallbacks for anchor functions in calc() functions. r=#anchor-pos

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c55071f4ec2e
https://hg.mozilla.org/integration/autoland/rev/c6034d39deb7
Ensure that <number> fallbacks are disallowed in fallbacks for anchor functions in calc() functions. r=layout-anchor-positioning-reviewers,firefox-style-system-reviewers,emilio

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/55917 for changes under testing/web-platform/tests

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/c6034d39deb7

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Reproducible on a 2025-11-04 Firefox Nightly build on Windows 10.

Verified as fixed on Firefox Nightly 147.0a1 and Firefox 146.02 on Windows 10, Ubuntu 22, macOS 15.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.